diff options
| author | Chris Liddell <chris.liddell@artifex.com> | 2017-06-15 08:58:31 +0100 |
|---|---|---|
| committer | Chris Liddell <chris.liddell@artifex.com> | 2017-06-15 08:58:31 +0100 |
| commit | 7755e67116e8973ee0e3b22d653df026a84fa01b (patch) | |
| tree | c015be9c7bdc1548d5c3ea6efb42f51b4477c035 | |
| parent | f887813ad00d680e2ea5d81606fd21d1b68067af (diff) | |
Bug 698055: bounds check zone pointer in Ins_MDRP
| -rw-r--r-- | base/ttinterp.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/base/ttinterp.c b/base/ttinterp.c index e7c9d68f7..af457e89f 100644 --- a/base/ttinterp.c +++ b/base/ttinterp.c | |||
| @@ -3770,7 +3770,8 @@ static int nInstrCount=0; | |||
| 3770 | 3770 | ||
| 3771 | point = (Int)args[0]; | 3771 | point = (Int)args[0]; |
| 3772 | 3772 | ||
| 3773 | if ( BOUNDS( args[0], CUR.zp1.n_points ) ) | 3773 | if ( BOUNDS( args[0], CUR.zp1.n_points ) || |
| 3774 | BOUNDS( CUR.GS.rp0, CUR.zp0.n_points) ) | ||
| 3774 | { | 3775 | { |
| 3775 | /* Current version of FreeType silently ignores this out of bounds error | 3776 | /* Current version of FreeType silently ignores this out of bounds error |
| 3776 | * and drops the instruction, see bug #691121 | 3777 | * and drops the instruction, see bug #691121 |